How to set the SP metadata expiration date

[Yaowen Tu]

Thanks Scott. I still don't quite understand your comments about
"validUntil".

Can you tell me how should I interpret this sentence in SAML spec: When
used as the root element of a metadata instance, this element MUST contain
either a validUntil or cacheDuration attribute.

You said it depends on my trust model. Could you please elaborate a little
bit more? When it is a "must" and when it is optional? or just give me a
simple example?

 I have referred to this wiki:
https://wiki.shibboleth.net/confluence/display/SHIB2/Metadata, and its sub
pages, but I didn't find related discussion.


Thanks,
Yaowen


On Thu, Oct 18, 2012 at 11:59 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 10/18/12 2:14 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:
> >
> >1) As you suggested, I read the SAML spec. In saml-metadata-2.0-os.pdf,
> >when describing the <EntitiesDescriptor> and <EntityDescriptor> element,
> >I found this sentense:
> >              When used as the root element of a metadata instance, this
> >element MUST contain either a validUntil
> >or cacheDuration attribute.
> >    Does it mean in the metadata, the root <EntityDescriptor> needs to
> >include "validUntil"? Why you said it is optional?
>
> Well, it says one or the other. The real answer is, it depends. Depends on
> your trust model, your metadata exchange model, etc. You have to supply
> all the context, or you're asking us to guess what you're thinking of
> doing.
>
> The wiki discusses the trust implications of different models of metadata
> exchange in the Metadata topic (or a sub page of that).
>
> >2) If I want to use Shibboleth SP. How can I produce a production level
> >metadata file? Do I need to manually edit it based on what ever Shib SP
> >has generated?
>
> You should, yes. You can't use metadata properly if it's limited to only
> what the SP produces or if it's tightly derived from the running
> configuration. Key rollover is not feasible for example.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121018/9a3b6acc/attachment.html